Add explicit permissions to GitHub workflows

Author: labkey-tchad

.github/workflows/branch_release.yml

@@ -8,6 +8,10 @@ on:
     tags:
       - '*'
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   branch_release:
     if: github.event.created && github.event.sender.login == 'labkey-teamcity'

.github/workflows/merge_release.yml

@@ -8,6 +8,10 @@ on:
     types:
       - submitted
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   merge_release:
     if: >

.github/workflows/validate_pr.yml

@@ -10,6 +10,9 @@ on:
       - reopened
       - ready_for_review
 
+permissions:
+  pull-requests: write
+
 jobs:
   validate_pr:
     if: github.event.pull_request.head.repo.owner.login == 'LabKey'

modules/simpletest/resources/scripts/validationTest/actionUrlTest.js

@@ -21,21 +21,21 @@ function doTest()
 
     if (contextPath.length > 0) {
         var baseUrl = LABKEY.ActionURL.getBaseURL();
-        if (baseUrl.indexOf("labkey/") != baseUrl.length - 7)
+        if (!baseUrl.endsWith(contextPath + "/"))
             errors[errors.length] = new Error("ActionURL.getBaseURL() = " + baseUrl);
     }
 
     var queryString = LABKEY.ActionURL.queryString(urlParameters);
-    if( queryString != 'x=fred&y=barney' )
+    if( queryString !== 'x=fred&y=barney' )
         errors[errors.length] = new Error("ActionURL.queryString = " + queryString);
 
     var url = LABKEY.ActionURL.buildURL(controller, action, containerPath, urlParameters);
-    if( url != contextPath + "/" + controller + "/" + containerPath + "/" + action + ".view?" + queryString  &&
-        url != contextPath + "/" + containerPath + "/" + controller + "-" + action + ".view?" + queryString)
+    if( url !== contextPath + "/" + controller + "/" + containerPath + "/" + action + ".view?" + queryString  &&
+        url !== contextPath + "/" + containerPath + "/" + controller + "-" + action + ".view?" + queryString)
         errors[errors.length] = new Error("ActionURL.buildUrl() = " + url);
 
     var parameters = LABKEY.ActionURL.getParameters(url);
-    if( Ext.util.JSON.encode(parameters) != Ext.util.JSON.encode(urlParameters) )
+    if( Ext.util.JSON.encode(parameters) !== Ext.util.JSON.encode(urlParameters) )
         errors[errors.length] = new Error("ActionURL.getParameters() = " + Ext.util.JSON.encode(parameters));
 
     if( errors.length > 0 )

src/org/labkey/test/TestFileUtils.java

@@ -635,6 +635,10 @@ private static List<File> unTar(final File inputFile, final File outputDir) thro
             while ((entry = inputStream.getNextEntry()) != null)
             {
                 final File outputFile = new File(outputDir, entry.getName());
+
+                if (!outputFile.toPath().normalize().startsWith(outputDir.toPath()))
+                    throw new IOException("Bad zip entry (" + entry.getName() + ") in " + inputFile.getAbsolutePath());
+
                 if (entry.isDirectory())
                 {
                     if (!outputFile.exists())